This is shockingly bad. Like so bad it has to be malice, right? To make requests over HTTP instead of HTTPS you have to do so intentionally, right? > Which pro

This is shockingly bad. Like so bad it has to be malice, right? To make requests over HTTP instead of HTTPS you have to do so intentionally, right? > Which product manager in his/her right mind, thought this was passable when you're building and marketing your product as an iMessage alternative and every single early access reviewer raised these exact security concerns in public? This all falls on technical leadership and the software engineers. No passing the buck to non-technical people who aren't reading or writing code and probably don't understand encryption (although they should at a place like this).